CVE-2023-22454 Discourse vulnerable to Cross-site Scripting through pending post titles descriptions

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has...

CVE-2023-22454 Discourse vulnerable to Cross-site Scripting through pending post titles descriptions

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has...

CVE-2023-22454

Discourse is affected by a Cross-Site Scripting (XSS) vulnerability (CVE-2023-22454) where pending post titles can be crafted by unprivileged users in categories that require moderator approval, potentially leading to full XSS on sites with relaxed CSP. The issue is addressed in patches for stabl...